changeset 53370:cfc839f28b89

8216426: Usage of array placement new may lead to memory corruption Reviewed-by: rehn, kbarrett, rkennke, eosterlund
author mdoerr
date Tue, 15 Jan 2019 10:23:23 +0100
parents 07c09e65ca0f
children 91ab128a65a3
files src/hotspot/share/utilities/concurrentHashTable.hpp src/hotspot/share/utilities/concurrentHashTable.inline.hpp
diffstat 2 files changed, 7 insertions(+), 3 deletions(-) [+]
line wrap: on
line diff
--- a/src/hotspot/share/utilities/concurrentHashTable.hpp	Wed Jan 16 11:15:25 2019 +0530
+++ b/src/hotspot/share/utilities/concurrentHashTable.hpp	Tue Jan 15 10:23:23 2019 +0100
@@ -73,7 +73,7 @@
     void print_value_on(outputStream* st) const {};
   };
 
-  // Only constructed with placement new[] from an array allocated with MEMFLAGS
+  // Only constructed with placement new from an array allocated with MEMFLAGS
   // of InternalTable.
   class Bucket {
    private:
--- a/src/hotspot/share/utilities/concurrentHashTable.inline.hpp	Wed Jan 16 11:15:25 2019 +0530
+++ b/src/hotspot/share/utilities/concurrentHashTable.inline.hpp	Tue Jan 15 10:23:23 2019 +0100
@@ -193,8 +193,12 @@
 {
   assert(_log2_size >= SIZE_SMALL_LOG2 && _log2_size <= SIZE_BIG_LOG2,
          "Bad size");
-  void* memory = NEW_C_HEAP_ARRAY(Bucket, _size, F);
-  _buckets = new (memory) Bucket[_size];
+  _buckets = NEW_C_HEAP_ARRAY(Bucket, _size, F);
+  // Use placement new for each element instead of new[] which could use more
+  // memory than allocated.
+  for (size_t i = 0; i < _size; ++i) {
+    new (_buckets + i) Bucket();
+  }
 }
 
 template <typename VALUE, typename CONFIG, MEMFLAGS F>